Rethinking Crappy Legal Identities to Reduce Fraud

Guy Huntington, President, Huntington Ventures LtdJuly 29, 2020

What’s Covered?

• Introduction• Fraud costs from a crappy legal identity• Rethinking identity from the ground up• Legal self-sovereign identity (LSSI)• Corporate SSI to offer to your customers while governments slowly

move towards an LSSI

Who Am I?

• My wife calls me an old fart• I’ve led many large complex identity projects including Boeing, Capital

One and Government of Alberta’s Digital Citizen Identity & Authentication project

• I’m a combination of a visionary, and an implementor, who likes to leave behind a sustainable framework system, long after I’m over the horizon

• I get my teams to view the framework from the governance, business process and technical perspectives, looking for attack vectors

Costs of a Crappy Legal Identity

1. Ad fraud – Estimated $42 billion a year2. Synthetic identity theft – Estimated annual US costs of $6 billion with 1

million child identities stolen and used3. Identity theft – Estimated US costs of $16.9 billion a year4. Medical identity theft – Estimated US medical identity theft in 2019 of

382 breaches, costing over $2.45 billion

In ”Costs of a Crappy Legal Identity” (https://www.linkedin.com/pulse/costs-crappy-legal-identity-guy-huntington?trk=portfolio_article-card_title) I provide links to references for the above

Our Legal Identity System is Broke

• My premise:• It’s based on an ancient civil registration vital statistics (CRVS) system• Which uses old technology, i.e. paper• That doesn’t tie the person holding the piece of paper to the person• With no data standards• And no ability to query all CRVS systems around the planet to confirm an

identity• This has resulted in creation of unique identification numbers like

SSN/SIN’s et al, which the previous slide shows are easy to maliciously obtain and use

• Then there’s the future rushing at us…

The Future is Now• Emerging virtual selves requiring legal identities

• https://hvl.net/pdf/Digital%20TwinsVirtualSelvesIdentitySecurityDeathFeb142020.pdf• AI Systems

• As these systems emerge, they're now able to legally run a company, write like us, patents are being applied on their behalf, running conversations with 650 million people, misinformation caused by bots, etc. How is their legal identity going to be determined?

• https://hvl.net/pdf/ArtificialIntelligenceLegalIdentificationMarch2020.pdf• Death & Digital Identities

• How are banks et al going to be notified when a physical person dies, and their digital entities keep existing, thinking and acting?

• https://www.linkedin.com/pulse/death-digital-identities-guy-huntington?trk=portfolio_article-card_title

• https://www.linkedin.com/pulse/im-dying-know-guy-huntington?trk=portfolio_article-card_title

YIKES!!!!!!!

• It requires a fundamental rethink in both human and AI System/Bot legal identities

Rethink Legal Identity

I’m working on two fronts:• Governments rethinking legal human and AI system/Bot legal identity• Corporations, i.e. banks/credit card companies, creating their own

identity system for their customers to use• i.e. Pat Scannell’s curve shows the rate of political change is slow

Governments

• Together with Michael Kleeman, we co-wrote two proposals:• Rethinking Human Legal Identity

• https://hvl.net/pdf/ProposalsPaperDec42019Final.pdf

• AI System/Bot Legal Identities• https://hvl.net/pdf/BotsIdentificationJan22020Final.pdf

• Note: Read the appendix slide on biometrics, since biometrics weren’t included in the human proposal

100,000 Foot View

• At birth, obtain a person’s fingerprints and iris scan, and write these to a new CRVS system which is to global standards

• Write an anonymous entry into a TODA like system, with a hash being written to a NFC enabled physical identity card, to global standards

• Write legal identity information to the physical card and sync it with a legal digital NFC enabled app, to global standards

• Write an anonymous attestation to the same, indicating the person is a human, and either above or below age of consent

• Obtain a face image and write this to the physical/digital device• Create a legal self-sovereign identity (LSSI) the person now controls

Enable CRVS’s to be Globally Queried

• The proposal establishes global standards for CRVS’s both in terms of data as well as queries

• This enables a person presenting themselves to a CRVS for a CRVS event, like name/gender change, marriage, divorce and death, to have their biometrics securely obtained, and then queried globally to confirm their identity

• From birth on, a person would have the highest level of identity assurance

LSSI Can Be Used in Many Different Ways

• Read this proposal I sent to the Canadian government showing them how to leverage a LSSI for Covid, et al

• https://hvl.net/pdf/CdnLSSICovidBusinessGovernmentPresenttionMay282020GH.pdf• Read this post “Do You Know Your Customers?” to see how it envisions leveraging

LSSI to change the ad fraud game• https://www.linkedin.com/pulse/advertising-fraud-identity-future-guy-

huntington?trk=portfolio_article-card_title• Read this post “Digital Health Records & Legal Identity” to see how LSSI can

change health fraud• https://www.linkedin.com/pulse/digital-health-record-legal-identity-guy-

huntington?trk=portfolio_article-card_title• Read this post “Covid, Sex & Identities” to see how it protects children

• https://www.linkedin.com/pulse/covid-sex-identities-guy-huntington?trk=portfolio_article-card_title

Tie Digital Legal Identities To Physical LSSI

• Premise:• Where the risk warrants it, create legal digital identities which are tied in the

new age CRVS to the underlying physical identity• Read “Digital and Physical Identities - All That Glitters Is Not Gold”

where I discuss Fraud 4.0, digital identities, et al• https://www.linkedin.com/pulse/digital-physical-identities-all-glitters-gold-

guy-huntington?trk=portfolio_article-card_title• Note:

• Digital entities are rapidly becoming “smarter” than us, and will increasingly be able to ”think” and “act” on our behalf

• They also live on long after we’re dead

Create a Corporate SSI For Bank/Credit Card Customers• Create a similar system we’ve proposed for governments, which

banks/credit card companies can offer to their customers, reducing fraud risk, and increasing revenues

• Which, for this presentation, I’ll call it a CCSSI (i.e. a corporate customer self-sovereign identity)

100,000 Foot Level

• Offer a new service to your customers• Register them and their children, by obtaining their fingerprints and

iris scan• Write an anonymous entry into a TODA like system, obtain the hash,

and write it to the NFC enabled credit card/digital app (all to global standards)

• Write identity information to the physical card and digital app• Take their face image and write this to the physical/digital devices• Now the customer has their own corporate issued personal identity

card they can choose how to release portions of their identity to

It Depends on Risk Using Their CCSSI

• Jane Doe can anonymously click on an ad, using her CCSSI• For which the advertiser would pay the bank/credit card company a very small fee

• She can choose to release increasing portions of her identity • The more she releases, the more the bank/credit card company is paid

• For low to medium risk the CCSSI card/app will likely suffice• i.e. Jane has in her possession the card/app, plus she authenticates to them using a 4

digit pin (or see the appendix slide using a biometric), her face and a liveliness test must match, plus the hash must be verified

• For high risk• Jane will be required to go to a bank, present her biometrics in a secure manner,

which will be checked globally, to verify it’s Jane• The bank/credit card company will then be paid more to attest it’s Jane Doe

Leverage The CCSSI For Digital Entity Identities

If Jane Doe wants to create a virtual self, and use it to interact commercially with retailers, etc. she would do so by:• Going to a bank• Presenting her biometrics to have her identity verified• Have the system write a unique identifier to a piece of code within

the digital self (using new global standards to be created)• Her legal digital virtual self identity is then tied to her CCSSI

Mesh the CCSSI with the LSSI When It Emerges

• Design the CCSSI such that it can rely upon both the LSSI and it’s own underlying biometric database, if and when the LSSI emerges

• One potential hypothetical advantage of a new LSSI is the ability for the bank/credit card company to be automatically notified when a person physically dies

Become More Central to Your Customers’ Lives

• The emergence of e-currencies, et al means the traditional relationship between a bank/credit card company with your customers is changing

• Creating a CCSSI, it places the bank/credit card company in a central position in their physical/digital lives, since they use it almost everywhere to prove their identity

• At the same time, it reduces fraud risk, increases revenue, and creates a relationship with the customer from their birth on

Price CCSSI Services Based on Risk

• The bank/credit card company can be potentially liable when attesting Jane Doe is Jane Doe

• Therefore, price the model based on risk• High risk requires larger pricing to offset risk of liability

Summary

• In a recent post I used Bob Dylan's song "The times they are a changin’” to close

• As technology price points drop, and sophistication leveraging AI increases, the world changes

• Businesses can’t look backwards to judge what's coming at them • Increasingly, this no longer works• We live on a small planet, which requires the ability for a person to

legally identify themselves physically and digitally • Opportunity knocks for those who can see the waves of change

coming

Contact Information

• Guy Huntington• www.hvl.net• LinkedIn: https://www.linkedin.com/in/ghuntington• Cell: 1-780-289-2776• I live in West Vancouver, BC, Canada

• I do consulting with C-suites and Boards on LSSI

Appendix Slides

Keeping CCSSI Up With the Curve

• Suggest that credit card/banks expand their existing security services, by creating a continuous threat assessment centre for identity assurance for the CCSSI

• It would monitor everything from the governance, business process and technological infrastructure, producing threat assessments

• Banks and customers would be required to change their cards, apps, services et al, based on the threat risk

• This addresses Pat Scannell’s technology change curve, by always ensuring the entire identity ecosystem is secure

Identity Architecture for a Corporation

• I created this deck “Rethinking Corporate Human & AI/Bot Identities” which I suggest you folks read

• https://hvl.net/pdf/RethinkingCorporateHumanAIBotIdentities.pdf

• It lays out a new age identity architecture for companies• Within the deck, you’ll see me saying the age of LDAP is over, as well

as the diminishing requirement for traditional GUIDS within an enterprise

Creating a Personal IAM

• In my papers and posts, I call out for development of a personal IAM system

• Read page 12 on of this paper https://hvl.net/pdf/IAMTsunamiFutureMay2019.pdf

• I know of at least one company that’s coding for this• I have thought that banks/credit card companies, telcos and the

giants like Google et al, would be the entities who’d want to create this, to establish themselves closest to their customers

Anonymous Biometric Identifiers

• Rud Bolle’s innovative paper “Anonymous Biometric Identifiers –Revisited”

• Written in 2015, he proposes creating anonymous, revocable biometrics used for authentication

• https://hvl.net/pdf/BolleAnonymousBiometricIdentifiersRevisited2015.pdf

• I can see companies adopting this as a form of authentication for their customers

Biometrics for a CRVS/CCSSI

• In the incremental legal identity paper I cowrote with Michael Kleeman, we didn’t propose use of biometrics, writing a note in the appendix suggesting this would be a good idea

• In these two papers I did recommend use of biometrics pointing out some of the problems associated with biometrics and secure storage of them:

• “Where Shit Happens” Deploying AI, AR, VR, Robotics, Identity, Data & Consent in Challenging Parts of the Planet

• https://hvl.net/pdf/Where%20Shit%20Happens%20March%202019.pdf• Human Migration, Physical & Digital Legal Identity

• https://hvl.net/pdf/HumanMigrationPhysicalDigitalLegalIdentityMar2020.pdf

Human Cloning

We’ve come a long ways from Dolly the Sheep in 1996:• In China, Boyalife, currently clones 100,000 cows a year working

towards 1 million• https://www.boyalifegroup.com/our-business/genomics/

• In 2015, their CEO publicly stated they could clone humans but weren’t

• https://www.businessinsider.com/afp-china-clone-factory-scientist-eyes-human-replication-2015-12

• In effect, the cloning genie is out of the bottle• Governments and businesses will have to address how they’re going

to legally differentiate Jane Doe 1,2,3, 4, etc.

Rapid Rate of Change

• I recently wrote “You Can’t Hide” letting people know the rapid pace of change is going to affect their lives

• https://www.linkedin.com/pulse/you-cant-hide-guy-huntington?trk=portfolio_article-card_title

Schools and Change

• I’m a passionate person about learning• If you read this post “Bots in the Classroom” you’ll see my vision on

how to rethink schools leveraging LSSI, digital learning twin, bots in the classroom, et al

• https://www.linkedin.com/pulse/bots-classroom-guy-huntington?trk=portfolio_article-card_title

• Read this post to see my recommendations on how to start out creating a digital learning twin:

• https://www.linkedin.com/pulse/using-aidigital-learning-twins-assessment-education-guy-huntington?trk=portfolio_article-card_title